Versions Compared

    Key

    • This line was added.
    • This line was removed.
    • Formatting was changed.
    Comment: Published by Scroll Versions from this space and version 6.9-0

    ...

    User permissions take precedence over group permissions. For example, if a user doesn't have permission to kill a job, even if their group permissions allow it, the user still won't be able to kill a job. A user with "administrator" or "impersonate" privileges is not subject to this restriction.

    A common group permission scenario: set of users with a "group" administrator

    You can use the Group permissions to create a set of users, and then make only certain users have the admin rights to this restricted set of users.

    The trick is to add the user to the new group with no permissions. You'll end up with a user of the same name (but not in the group) with the same set of permissions as the [default] permission set. Then, grant the privileged user in that group the admin privilege.

    The cmdline-equivalent is:

    No Format
    jburk-15-mbPro:~ root# qbusers --add --group showA foo jburk  ## neither user was explicitly granted privileges before this
    modified group permissions
    
    jburk-15-mbPro:~ root# qbusers --list
    total 8
    ---l jc- krmpbuicseyqg-vftn [default]
    asil jcg krmpbuicseyqgpvftn administrator
    ---- --- ------------------ bar
    ---l jc- krmpbuicseyqg-vftn foo [default] 
    ---l jc- krmpbuicseyqg-vftn jburk [default] 
    asil jcg krmpbuicseyqgpvftn qube
    asil jcg krmpbuicseyqgpvftn qubesupe
    asil jcg krmpbuicseyqgpvftn root
    asil jcg krmpbuicseyqgpvftn system
    
    jburk-15-mbPro:~ root# qbusers --member  
    group total 8
    [default]
    -- ------------------   default
    
    foo
    -- ------------------   showa
    
    jburk
    -- ------------------   showa

    Notice that both users "jburk" and "foo" in the "showa" group have no "group" privilege. Both users still still have exactly the same privileges as if they weren't explictly granted privileges; they can't modify each other's jobs.

    Then grant the 'admin' privilege to 'jburk', but only in the "showA" group, that user's privileges remain unchanged outside of that group.

    No Format
    jburk-15-mbPro:python jburk$ qbusers --group showa --add --admin jburk
     
    jburk-15-mbPro:~ root# qbusers --list 
    total 8
    ---l jc- krmpbuicseyqg-vftn [default]
    asil jcg krmpbuicseyqgpvftn administrator
    ---- --- ------------------ bar
    ---l jc- krmpbuicseyqg-vftn foo [default] 
    ---l jc- krmpbuicseyqg-vftn jburk [default] 
    asil jcg krmpbuicseyqgpvftn qube
    asil jcg krmpbuicseyqgpvftn qubesupe
    asil jcg krmpbuicseyqgpvftn root
    asil jcg krmpbuicseyqgpvftn system
    
    jburk-15-mbPro:~ root# qbusers --member     
    group total 8
    [default]
    -- ------------------   default
    
    foo
    -- ------------------   showa
    
    jburk
    a- ------------------   showa
    
    jburk-15-mbPro:~ root# qbusers --group showA --drop foo
    modified group permissions
    
    jburk-15-mbPro:~ root# qbusers --list 
    total 7
    ---l jc- krmpbuicseyqg-vftn [default]
    asil jcg krmpbuicseyqgpvftn administrator
    ---- --- ------------------ bar
    ---l jc- krmpbuicseyqg-vftn jburk [default] 
    asil jcg krmpbuicseyqgpvftn qube
    asil jcg krmpbuicseyqgpvftn qubesupe
    asil jcg krmpbuicseyqgpvftn root
    asil jcg krmpbuicseyqgpvftn system

     

    Common Permission Actions


    Users

    List users and their permissions:
    WranglerView: See the Users Layout for a hierarchical list
    Command-line: qbusers --list

    Add one or more users and assign permissions:
    WranglerView: In User Layout, right-click and select "Add New User"
    Command-line: (Use format for --add under changing a user's permissions)

    Change a user's permissions:
    WranglerView: In User Layout, select user, right-click "Change Permissions"
    Command-line (Add Permission): qbusers --add permission [permission,…] user [user,…]

    Note: the "--all" option will add all non-admin user permissions for the user
    Command-line (Remove Permission): qbusers --delete permission [permission,…] user [user,…]

    Delete a user:
    WranglerView: In User Layout, select user, right-click "Remove User/Group"
    Command-line: qbusers --drop user [user…] 

    Groups

    List group membership:
    WranglerView: See the Users Layout for a hierarchical list
    Command-line: qbusers --member

    Add User to a Group:
    WranglerView: In User Layout, select user, right-click "Add User Group"
    Command-line: qbusers --add --group group user [user,…]

    Remove User from a Group:
    WranglerView: In User Layout, select user group, right-click "Remove User/Group"
    Commmand-line: qbusers --drop --group group user [user,…]

    Change permissions to the user group:
    WranglerView: In User Layout, select user group, right-click "Change Permissions"
    Command-line (Add Permission): qbusers --group group --add permission [permission,…] user [user…]
    Command-line (Remove Permission): qbusers --group group --delete permission [permission,…] user [user…]

    ...